oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2026-11-02 07:26:34 +01:00
Code Issues Packages Projects Releases Wiki Activity
2,070 Commits 65 Branches 273 Tags
25b55e1704c9afaf0969c1a2d4bbe74251b979d1
Commit Graph
570 Commits
Author SHA1 Message Date
guangwuandChristopher Phillips 25b55e1704 fix: close temp rpmdb file (#2792) 
* fix: close temp rpmdb file and db

Signed-off-by: guoguangwu <guoguangwug@gmail.com>

* chore: fix linter

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

---------

Signed-off-by: guoguangwu <guoguangwug@gmail.com>
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>
 2024-04-30 12:47:17 -04:00
Alex Goodman 5b03788300 Fill in SPDX originator for all supported package types (#2822) 
* add failing test + beef up doc comments

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* cover more metadata types in spdx originator processing

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-04-29 16:33:00 -04:00
Weston Steimel 8640f978ba feat: index known CPEs for go modules (#2816) 
Signed-off-by: Weston Steimel <commits@weston.slmail.me>
 2024-04-26 09:55:05 -04:00
Weston Steimel 9604e3dc9c feat: support multiple known CPEs in index (#2813) 
It is possible that a given package has multiple known "official" CPEs
active in the dictionary at once, so the index should support a slice of
CPE strings per package

Signed-off-by: Weston Steimel <commits@weston.slmail.me>
 2024-04-25 15:22:26 +01:00
Weston Steimel 99b58db497 fix: prefer non-deprecated CPEs and include jenkins plugins from plugins.jenkins.io (#2806) 
Improves the logic for adding known CPEs for Jenkins plugins by
including `plugins.jenkins.io` and prefers non-deprecated CPEs

Signed-off-by: Weston Steimel <commits@weston.slmail.me>
 2024-04-23 11:11:47 -04:00
Weston Steimel 8d960e62c6 feat: index known CPEs for PHP Composer packagist.org packages (#2804) 
Indexes known CPEs from `packagist.org`

Signed-off-by: Weston Steimel <commits@weston.slmail.me>
 2024-04-23 10:42:59 -04:00
Weston Steimel 891e61a2ef fix: improvements to known CPE index construction (#2801) 
* fix: stop pre-filtering potential known CPE URLs

Previously when building the known CPE index, there was logic to
de-duplicate processing based on the normalized CPE name; however, this
means a significant number of known CPE's don't get indexed because the
first instance of that name didn't have a supported collection url but a
later one did.  This isn't code that executes at runtime in syft so
de-duplicating the processing for performance isn't really necessary
here and it doesn't add much to the total runtime anyways

Signed-off-by: Weston Steimel <commits@weston.slmail.me>

* fix: CPE index builder should extract and consider all reference urls

Previously the struct definition for CpeItem caused only the last URL
reference in the list to be kept and processed for inclusion in the
index

Signed-off-by: Weston Steimel <commits@weston.slmail.me>

---------

Signed-off-by: Weston Steimel <commits@weston.slmail.me>
 2024-04-23 09:28:18 -04:00
Keith Zantow f7d3d552ce fix: exclude known instrumentation jars from being erroneously identified (#2796) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-04-22 15:03:17 -04:00
Weston Steimel 12ea9912b4 feat: index known cpes for PHP extensions (#2777) 
Indexes known CPEs from `pecl.php.net` and `pear.php.net`

Signed-off-by: Weston Steimel <commits@weston.slmail.me>
 2024-04-22 13:43:19 -04:00
William Murphy 6440f26b5a fix: return empty string if dereferncing pom var fails (#2797) 
Previously, Syft would attempt to dereference pom variables, but if it
detected a cycle or failed to get back to a non-variable value, it would
return the last variable. Instead, return an empty string. Otherwise,
certain jars will have versions like "${project.version}" in the SBOM,
which is not helpful.

Signed-off-by: Will Murphy <will.murphy@anchore.com>
 2024-04-19 19:38:36 +00:00
guangwu fe4819bc08 chore: cleanup redundant code (#2791) 
Signed-off-by: guoguangwu <guoguangwug@gmail.com>
 2024-04-19 12:12:48 -04:00
William Murphy 3e71f46fc8 Fix: repeatedly dereference pom variables (#2781) 
* Fix: repeatedly dereference pom variables

Previously, if there was more than one layer of variable indirection in
the pom property (propert A says it has the same value as property B,
property B says it has the same value as property C), then Syft would
only dereference one layer. Add a loop to dereference variables until
either dereferencing fails, or until the variable is completely
dereferenced back to a literal.

Signed-off-by: Will Murphy <will.murphy@anchore.com>

* switch to recursive implementation

Signed-off-by: Will Murphy <will.murphy@anchore.com>

* add test cases for degenerate poms

Signed-off-by: Will Murphy <will.murphy@anchore.com>

* switch to recursive implementation

Signed-off-by: Will Murphy <will.murphy@anchore.com>

* remove redundant pieces of test cases

Signed-off-by: Will Murphy <will.murphy@anchore.com>

---------

Signed-off-by: Will Murphy <will.murphy@anchore.com>
 2024-04-16 15:44:02 -04:00
anchore-actions-token-generator[bot]andwestonsteimel 25c2e60358 chore(deps): update CPE dictionary index (#2780) 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: westonsteimel <1593939+westonsteimel@users.noreply.github.com>
 2024-04-15 11:15:38 -04:00
Keith ZantowandWill Murphy dde5d349b1 fix: more robust go main version extraction (#2767) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
Signed-off-by: Will Murphy <will.murphy@anchore.com>
Co-authored-by: Will Murphy <will.murphy@anchore.com>
 2024-04-11 11:58:51 -04:00
Laurent GoderreandKeith Zantow c9aab4863b fix: binary character in java version (#2766) 
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>
Signed-off-by: Keith Zantow <kzantow@gmail.com>
Co-authored-by: Keith Zantow <kzantow@gmail.com>
 2024-04-11 10:32:24 -04:00
Laurent Goderre 619ace65c3 Differentiate between JRE and JDK (#2748) 
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>
 2024-04-05 15:10:58 -04:00
Christopher Angelo Phillips e100776f22 chore: update anchore/packageurl-go to use latest commits (#2746) 
chore: update packageurl-go dependency to use latest commits
chore: go mod tidy
unit: update + -> %2B
---------
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2024-04-04 10:33:51 -04:00
Laurent Goderre e0233625cb feat: cataloger for PHP Pecl and PEAR packages (#2604) 
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>
 2024-04-02 11:55:56 -04:00
Keith Zantow 01340b2a5c fix: conan poco project cpe (#2740) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-03-28 16:56:24 -04:00
Colm O hEigeartaigh f4e18961b9 Adding the ability to retrieve remote licenses from package.lock (#2708) 
Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org>
 2024-03-21 13:20:04 -04:00
Laurent GoderreandAlex Goodman cf17bd69b2 Add detection for Oracle GraalVM (#2705) 
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-03-14 15:40:07 +00:00
brian-ebarbColleen DiversAlex Goodman
 		6a2517b5d2 Add ELF binary package cataloger (#2396) 
* feat Adds Elf package catalogger

Signed-off-by: Brian Ebarb <ebarb.brian@gmail.com>

* Add test fixtures for elf package

Signed-off-by: Colleen Divers <colleen.divers@gmail.com>

* bump JSON schema to v16.0.6 + expand test fixtures

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* less verbose logging

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* remove dead test code

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* remove unreleated swift change

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Brian Ebarb <ebarb.brian@gmail.com>
Signed-off-by: Colleen Divers <colleen.divers@gmail.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Colleen Divers <colleen.divers@gmail.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-03-14 11:16:03 -04:00
Alex Goodman 47fc909700 Show binary exports, entrypoint, and imports (#2626) 
show binary exports, entrypoint, and imports for macho, elf, and pe formats

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-03-12 22:04:02 +00:00
guangwu 3743f5ae53 chore: reduce duplicate case SwiftPkg (#2696) 
Signed-off-by: guoguangwu <guoguangwug@gmail.com>
 2024-03-07 18:15:31 +00:00
guangwu ebb9d4edb6 chore: remove deprecated os.SEEK_SET os.SEEK_CUR (#2693) 
Signed-off-by: guoguangwu <guoguangwug@gmail.com>
 2024-03-07 13:10:48 -05:00
Harm Weites 356f7c92b4 fix: match OpenSSL letter releases (#2682) 
* chore: match openssl 1.1 letter releases

Signed-off-by: Harm Weites <harm@weites.com>

* chore: include image sha

Signed-off-by: Harm Weites <harm@weites.com>

---------

Signed-off-by: Harm Weites <harm@weites.com>
 2024-02-29 14:39:23 +00:00
William Murphy 3ad91f2678 fix: trim path from deps.json in portable way (#2674) 
* fix: trim path from deps.json in portable way

Previously, the path trimming regex would leave leading path separator
in place on Windows.

Probably a better long term fix is to a library path operation.

Signed-off-by: Will Murphy <will.murphy@anchore.com>
 2024-02-29 09:31:55 -05:00
William Murphy 63171b55dd fix: stop emitting bus events on go mod events (#2673) 
Previously, the TUI would hang when scanning directories with lots of go
packages, possibly because this path was spamming the TUI with too
many events. Since checking on a particular go module is fast, don't
show TUI events for each one.

Signed-off-by: Will Murphy <will.murphy@anchore.com>
 2024-02-28 14:14:46 -05:00
Keith Zantow a978966cad feat: add --from flag, refactor source providers (#2610) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-02-27 16:44:37 -05:00
Alex Goodman 0c3b8ca4ed rename binary classifier cataloger name (#2643) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-02-20 13:52:11 -05:00
Alexandr HacicheantandAlex Goodman 96ee2db875 feat: Add Wordpress cataloger (#2218) 
* Closes #1911 Wordpress cataloger

Signed-off-by: disc <a.hacicheant@gmail.com>

* Fixed a few unit tests and static analizer notices

Signed-off-by: disc <a.hacicheant@gmail.com>

* Updated `README.md`

Signed-off-by: disc <a.hacicheant@gmail.com>

* Fixed `golangci-lint` notices
Added integration test for `wordpress-plugin`

Signed-off-by: disc <a.hacicheant@gmail.com>

* Fixed `gosimports` notices

Signed-off-by: disc <a.hacicheant@gmail.com>

* Updated `json schema` version

Signed-off-by: disc <a.hacicheant@gmail.com>

* Fixed CLI tests, increased expected package count

Signed-off-by: disc <a.hacicheant@gmail.com>

* Read first 4Kb of a plugins file's content

Signed-off-by: disc <a.hacicheant@gmail.com>

* replace JSON schema version

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* change wording on source info for wordpress packages

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* Minor changes after a huge refactoring

Signed-off-by: disc <a.hacicheant@gmail.com>

* Removed unused files

Signed-off-by: disc <a.hacicheant@gmail.com>

* Updated schema

Signed-off-by: disc <a.hacicheant@gmail.com>

* Fixed integration tests

Signed-off-by: disc <a.hacicheant@gmail.com>

* fix integration tests

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* Renamed `metadata.Name` to `metadata.PluginInstallDirectory`

Signed-off-by: disc <a.hacicheant@gmail.com>

* rename fields to be compliant with json conventions

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: disc <a.hacicheant@gmail.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-02-14 16:03:25 +00:00
Alex Goodman 98b700e83c rename binary cataloger to be more unique (#2633) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-02-14 11:01:55 -05:00
anchore-actions-token-generator[bot]spiffcsChristopher Phillips
 		17ef243956 chore(deps): update tools to latest versions (#2616) 
* chore(deps): update tools to latest versions

Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

* fix: update to new linter rules

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

---------

Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>
Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com>
 2024-02-14 14:59:49 +00:00
Alex Goodman 84576b93e1 Guess go main module version based on binary contents (#2608) 
* guess go main module version based on binary contents

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add configuration options for golang main module version heuristics

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix test setup for go bin cataloger

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix unit test

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix incorrect test assert ordering

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* handle error from seek

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-02-09 19:52:42 +00:00
Christopher Angelo Phillips c0f43e5e2d chore: update license list, cpe dictionary (#2620) 
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>
 2024-02-09 11:31:42 -05:00
William Murphy ce67927a98 Fix: unmarshal key values in Java, Go, and Conan metadata (#2603) 
Previously, Syft represented several metadata fields as map[string]string,
however this representation erased ordering, so Syft now represents these values
as []KeyValue. Add custom unmarshaling so that JSON that was written by
older versions of Syft using the map[string]string representation can be parsed
into the new []KeyValue representation.

Signed-off-by: Will Murphy <will.murphy@anchore.com>
 2024-02-07 11:26:23 -05:00
Weston Steimel bbd34f61fd fix(dotnet): prefer portable executable product version when semantically greater than file version (#2600) 
Signed-off-by: Weston Steimel <weston.steimel@anchore.com>
 2024-02-07 13:28:37 +00:00
Alex Goodmanandmikey strauss c61f59e7b7 Finalize Conan v2 support (#2587) 
* Add support for conan lock v2 (#2461)

* conan lock 2.x requires field support

Signed-off-by: houdini91 <mdstrauss91@gmail.com>

* PR review, struct renaming

Signed-off-by: houdini91 <mdstrauss91@gmail.com>

---------

Signed-off-by: houdini91 <mdstrauss91@gmail.com>

* decompose conanlock parser + add tests

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: houdini91 <mdstrauss91@gmail.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: mikey strauss <mdstrauss91@gmail.com>
 2024-02-07 08:24:02 -05:00
Asi GreenholtsandAlex Goodman 98de2e2f62 Adding metadata fields when parsing yarn.lock and poetry.lock (#2350) 
* Adding the resolved and integrity fields of yarn.lock to the parsed metadata. This addition is similar to the metadata added when parsing package-lock.json.

Signed-off-by: asi-cider <88270351+asi-cider@users.noreply.github.com>

* fix comment

Signed-off-by: asi-cider <88270351+asi-cider@users.noreply.github.com>

* Adding the Index field to metadeta when parsing poetry.lock similarly to the existing Pipfile metadata

Signed-off-by: asi-cider <88270351+asi-cider@users.noreply.github.com>

* fixing struct accoding to tests

Signed-off-by: asi-cider <88270351+asi-cider@users.noreply.github.com>

* remove old schema change

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* remove empty constants

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* re-generate JSON schema

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* update document ref

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix linting

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: asi-cider <88270351+asi-cider@users.noreply.github.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-02-02 19:53:42 +00:00
Laurent GoderreandAlex Goodman d7b9cc70b0 Add Erlang OTP Application cataloger (#2403) 
* Add cataloger for Erlang OTP applications

Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>

* Add OTP Package type and Purl for ErLang

Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>

* remove erlang OTP metadata type

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* use OTP purl type

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* restore otp fixture and adjust tests for dir-only results

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-02-02 13:40:18 -05:00
Alex Goodman 3023a5a7bc Detect ELF security features (#2443) 
* add detection of ELF security features

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix linting

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* update json schema with file executable data

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* update expected fixure when no tty present

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* more detailed differ

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* use json differ

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix tests

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* remove json schema addition

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* regenerate json schema

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* fix mimtype set ref

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-02-02 16:51:18 +00:00
William Murphy b7a6d5e946 feat: Record where CPEs come from (#2552) 
Syft can get CPEs from several source, including generating them based on
package data, finding them in the NVD CPE dictionary, or finding them declared
in a manifest or existing SBOM. Record where Syft got CPEs so that consumers of
SBOMs can reason about how trustworthy they are.

Signed-off-by: Will Murphy <will.murphy@anchore.com>
 2024-02-02 16:17:52 +00:00
Alex Goodman 5a9b664fef swap format readseekers for readers (#2581) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-02-01 14:18:13 -05:00
Alex Goodman 6107e5e2ad translate maps to sequences in pkg metadata (#2553) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-02-01 11:58:10 -05:00
Weston Steimel 3893f80052 fix(java): improve identification for org.apache.kafka artifacts (#2573) 
Signed-off-by: Weston Steimel <weston.steimel@proton.me>
 2024-01-31 16:34:56 -05:00
William Murphy 31e0fc36e3 fix: Better test for group ID in filename (#2565) 
This fixes an issue where filenames containing a period that aren't a
group ID, such as some-jar.12.jar, would be mistakenly be reported as
having the name "12" by syft, instead of the name "some-jar.12".

It works by testing whether the parts of the filename split on "."
are all valid Java identifiers.

Signed-off-by: Will Murphy <will.murphy@anchore.com>
 2024-01-31 08:21:33 -05:00
Alex Goodman f893933336 internalize format helpers (#2543) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-01-26 12:16:26 -05:00
Alex Goodman b6cbf82389 Internalize CPE generation logic (#2541) 
* migrate CPE generation logic to internal

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* remove create function

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-01-26 12:16:05 -05:00
Laurent Goderre d7c51e5c82 Implement golang Purl subpath (#2547) 
* Added test for golang package that include subpath into the module

Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>

* Implement golang purl subpath

Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>

---------

Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>
 2024-01-25 17:04:28 -05:00
Alex Goodman 11c0b1c234 Unexport types and functions cataloger packages (#2530) 
* unexport as many types and functions from cataloger packages as possible

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* capture type and signature information in convention test

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* check that we return pkg.Cataloger from constructors

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-01-24 16:12:46 -05:00